+

WO2007011673A3 - Automatically generating rules for connection security - Google Patents

Automatically generating rules for connection security Download PDF

Info

Publication number
WO2007011673A3
WO2007011673A3 PCT/US2006/027263 US2006027263W WO2007011673A3 WO 2007011673 A3 WO2007011673 A3 WO 2007011673A3 US 2006027263 W US2006027263 W US 2006027263W WO 2007011673 A3 WO2007011673 A3 WO 2007011673A3
Authority
WO
WIPO (PCT)
Prior art keywords
security
rule
connection
firewall
automatically generating
Prior art date
Application number
PCT/US2006/027263
Other languages
French (fr)
Other versions
WO2007011673A2 (en
Inventor
Charles D Bassett
Pradeep Bahl
Ian M Carbaugh
Lokesh Srinivas Koppolu
Maksim Noy
Sarah A Wahlert
Eran Yariv
Original Assignee
Microsoft Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Microsoft Corp filed Critical Microsoft Corp
Priority to EP06787203A priority Critical patent/EP1905180A2/en
Priority to JP2008521620A priority patent/JP4892554B2/en
Publication of WO2007011673A2 publication Critical patent/WO2007011673A2/en
Publication of WO2007011673A3 publication Critical patent/WO2007011673A3/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F15/00—Digital computers in general; Data processing equipment in general
    • G06F15/16—Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Business, Economics & Management (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
  • Storage Device Security (AREA)

Abstract

A method and system for creating security policies (1 12) for firewall (122) and connection policies in an integrated manner is provided The security system provides a user interface through which a user can define a security rule that specifies both a firewall policy and a connection policy After the security rule is specified, the security system automatically generates a firewall rule and a connection rule to implement the security rule The security system provides the firewall engine that is responsible for enforcing the firewall rules and provides the connection rule to an IPsec engine that is responsible for enforcing the connection rules
PCT/US2006/027263 2005-07-15 2006-07-13 Automatically generating rules for connection security WO2007011673A2 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP06787203A EP1905180A2 (en) 2005-07-15 2006-07-13 Automatically generating rules for connection security
JP2008521620A JP4892554B2 (en) 2005-07-15 2006-07-13 Automatic generation of rules for connection security

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US11/183,317 US8056124B2 (en) 2005-07-15 2005-07-15 Automatically generating rules for connection security
US11/183,317 2005-07-15

Publications (2)

Publication Number Publication Date
WO2007011673A2 WO2007011673A2 (en) 2007-01-25
WO2007011673A3 true WO2007011673A3 (en) 2007-09-27

Family

ID=37663064

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2006/027263 WO2007011673A2 (en) 2005-07-15 2006-07-13 Automatically generating rules for connection security

Country Status (7)

Country Link
US (2) US8056124B2 (en)
EP (1) EP1905180A2 (en)
JP (1) JP4892554B2 (en)
KR (1) KR20080026177A (en)
CN (1) CN101238669A (en)
TW (1) TW200713954A (en)
WO (1) WO2007011673A2 (en)

Families Citing this family (78)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8250229B2 (en) * 2005-09-29 2012-08-21 International Business Machines Corporation Internet protocol security (IPSEC) packet processing for multiple clients sharing a single network address
JP4545085B2 (en) * 2005-12-08 2010-09-15 富士通株式会社 Firewall device
JP4690918B2 (en) * 2006-03-14 2011-06-01 株式会社リコー Network equipment
US8099774B2 (en) * 2006-10-30 2012-01-17 Microsoft Corporation Dynamic updating of firewall parameters
US7954143B2 (en) * 2006-11-13 2011-05-31 At&T Intellectual Property I, Lp Methods, network services, and computer program products for dynamically assigning users to firewall policy groups
US7702787B1 (en) * 2006-12-12 2010-04-20 Emc Corporation Configurable user management
US8533789B1 (en) 2006-12-12 2013-09-10 Emc Corporation User management for repository manager
US20080178256A1 (en) * 2007-01-23 2008-07-24 Brian Perrone System and method providing policy based control of interaction between client computer users and client computer software programs
US8392981B2 (en) * 2007-05-09 2013-03-05 Microsoft Corporation Software firewall control
US8166534B2 (en) * 2007-05-18 2012-04-24 Microsoft Corporation Incorporating network connection security levels into firewall rules
US8341723B2 (en) 2007-06-28 2012-12-25 Microsoft Corporation Filtering kernel-mode network communications
US8443433B2 (en) * 2007-06-28 2013-05-14 Microsoft Corporation Determining a merged security policy for a computer system
US8984620B2 (en) * 2007-07-06 2015-03-17 Cyberoam Technologies Pvt. Ltd. Identity and policy-based network security and management system and method
US20110238587A1 (en) * 2008-09-23 2011-09-29 Savvis, Inc. Policy management system and method
KR101006721B1 (en) * 2009-01-20 2011-01-07 킹스정보통신(주) Keyboard input information security device and method
US8214645B2 (en) * 2009-04-08 2012-07-03 Research In Motion Limited Systems, devices, and methods for securely transmitting a security parameter to a computing device
KR100917660B1 (en) * 2009-05-11 2009-09-18 (주)비전소프트 Network connection system between internal and external servers through a single port using a firewall adapter
CN101640614B (en) * 2009-09-03 2012-01-04 成都市华为赛门铁克科技有限公司 Method and device for configuring IPSEC security strategy
US20110075047A1 (en) * 2009-09-29 2011-03-31 Sony Corporation Firewall port selection using atsc tuner signals
WO2012031112A2 (en) * 2010-09-03 2012-03-08 Time Warner Cable, Inc. Methods and systems for managing a virtual data center with embedded roles based access control
US8914841B2 (en) * 2010-11-24 2014-12-16 Tufin Software Technologies Ltd. Method and system for mapping between connectivity requests and a security rule set
US9191327B2 (en) 2011-02-10 2015-11-17 Varmour Networks, Inc. Distributed service processing of network gateways using virtual machines
WO2013018025A1 (en) * 2011-08-04 2013-02-07 International Business Machines Corporation Security policy enforcement
US9189636B2 (en) 2012-07-30 2015-11-17 Hewlett-Packard Development Company, L.P. Office machine security policy
IL221975A (en) * 2012-09-19 2015-02-26 Tufin Software Technologies Ltd Method of managing connectivity between resources in a computer network and system thereof
EP2782311A1 (en) * 2013-03-18 2014-09-24 British Telecommunications public limited company Methods of testing a firewall, and apparatus therefor
TW201505411A (en) 2013-07-31 2015-02-01 Ibm Method of interpreting a rule and a rule-interpreting apparatus for rule-based security apparatus
US10768784B2 (en) * 2013-12-06 2020-09-08 Vivint, Inc. Systems and methods for rules-based automations and notifications
US10367787B2 (en) 2013-12-20 2019-07-30 Mcafee, Llc Intelligent firewall access rules
US9361432B2 (en) 2014-01-15 2016-06-07 Hewlett-Packard Development Company, L.P. Configuring a security setting for a set of devices using a security policy
US10091238B2 (en) * 2014-02-11 2018-10-02 Varmour Networks, Inc. Deception using distributed threat detection
US10264025B2 (en) 2016-06-24 2019-04-16 Varmour Networks, Inc. Security policy generation for virtualization, bare-metal server, and cloud computing environments
US9973472B2 (en) 2015-04-02 2018-05-15 Varmour Networks, Inc. Methods and systems for orchestrating physical and virtual switches to enforce security boundaries
US20150293862A1 (en) * 2014-04-10 2015-10-15 Andes Technology Corporation Hardware configuration apparatus
US9467324B2 (en) * 2014-05-12 2016-10-11 Michael C. Wood Firewall security for computers with internet access and method
US9882877B2 (en) * 2014-05-12 2018-01-30 Michael C. Wood Transparent traffic control device and method for securing internet-connected devices
US9756135B2 (en) * 2014-07-31 2017-09-05 Ca, Inc. Accessing network services from external networks
US9565216B2 (en) 2014-10-24 2017-02-07 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for security protocol selection in internet protocol multimedia subsystem networks
US9438634B1 (en) 2015-03-13 2016-09-06 Varmour Networks, Inc. Microsegmented networks that implement vulnerability scanning
US9467476B1 (en) 2015-03-13 2016-10-11 Varmour Networks, Inc. Context aware microsegmentation
US9294442B1 (en) 2015-03-30 2016-03-22 Varmour Networks, Inc. System and method for threat-driven security policy controls
US10193929B2 (en) 2015-03-13 2019-01-29 Varmour Networks, Inc. Methods and systems for improving analytics in distributed networks
US10178070B2 (en) 2015-03-13 2019-01-08 Varmour Networks, Inc. Methods and systems for providing security to distributed microservices
US9380027B1 (en) 2015-03-30 2016-06-28 Varmour Networks, Inc. Conditional declarative policies
US10009381B2 (en) 2015-03-30 2018-06-26 Varmour Networks, Inc. System and method for threat-driven security policy controls
US9525697B2 (en) 2015-04-02 2016-12-20 Varmour Networks, Inc. Delivering security functions to distributed networks
US9483317B1 (en) 2015-08-17 2016-11-01 Varmour Networks, Inc. Using multiple central processing unit cores for packet forwarding in virtualized networks
US10191758B2 (en) 2015-12-09 2019-01-29 Varmour Networks, Inc. Directing data traffic between intra-server virtual machines
US9762599B2 (en) 2016-01-29 2017-09-12 Varmour Networks, Inc. Multi-node affinity-based examination for computer network security remediation
US9680852B1 (en) 2016-01-29 2017-06-13 Varmour Networks, Inc. Recursive multi-layer examination for computer network security remediation
US9930029B2 (en) * 2016-02-25 2018-03-27 Nutanix, Inc. Hypervisor agnostic bidirectional secure channel for guest agent transport
US9992233B2 (en) 2016-03-14 2018-06-05 Michael C. Wood Enhanced firewall and method for securing internet communications
US9521115B1 (en) 2016-03-24 2016-12-13 Varmour Networks, Inc. Security policy generation using container metadata
US10523635B2 (en) * 2016-06-17 2019-12-31 Assured Information Security, Inc. Filtering outbound network traffic
US10755334B2 (en) 2016-06-30 2020-08-25 Varmour Networks, Inc. Systems and methods for continually scoring and segmenting open opportunities using client data and product predictors
US10673891B2 (en) 2017-05-30 2020-06-02 Akamai Technologies, Inc. Systems and methods for automatically selecting an access control entity to mitigate attack traffic
US10616280B2 (en) 2017-10-25 2020-04-07 Bank Of America Corporation Network security system with cognitive engine for dynamic automation
US10437984B2 (en) 2017-10-26 2019-10-08 Bank Of America Corporation Authentication protocol elevation triggering system
US10686684B2 (en) 2017-11-02 2020-06-16 Bank Of America Corporation Individual application flow isotope tagging within a network infrastructure
TW201926108A (en) * 2017-12-04 2019-07-01 和碩聯合科技股份有限公司 Network security system and method thereof
US10909010B2 (en) 2018-04-10 2021-02-02 Nutanix, Inc. Efficient data restoration
CN109255247B (en) 2018-08-14 2020-08-14 阿里巴巴集团控股有限公司 Multi-party security calculation method and device and electronic equipment
EP3627788A1 (en) * 2018-09-18 2020-03-25 Siemens Aktiengesellschaft Method and device for configuring an access control system
US11516182B2 (en) * 2019-04-10 2022-11-29 Google Llc Firewall rules intelligence
US11575563B2 (en) 2019-05-31 2023-02-07 Varmour Networks, Inc. Cloud security management
US11290494B2 (en) 2019-05-31 2022-03-29 Varmour Networks, Inc. Reliability prediction for cloud security policies
US11310284B2 (en) 2019-05-31 2022-04-19 Varmour Networks, Inc. Validation of cloud security policies
US11290493B2 (en) 2019-05-31 2022-03-29 Varmour Networks, Inc. Template-driven intent-based security
US11711374B2 (en) 2019-05-31 2023-07-25 Varmour Networks, Inc. Systems and methods for understanding identity and organizational access to applications within an enterprise environment
US11863580B2 (en) 2019-05-31 2024-01-02 Varmour Networks, Inc. Modeling application dependencies to identify operational risk
US11546301B2 (en) 2019-09-13 2023-01-03 Oracle International Corporation Method and apparatus for autonomous firewall rule management
US11283830B2 (en) * 2020-03-19 2022-03-22 Cisco Technology, Inc. Protecting device classification systems from adversarial endpoints
US11818152B2 (en) 2020-12-23 2023-11-14 Varmour Networks, Inc. Modeling topic-based message-oriented middleware within a security system
US11876817B2 (en) 2020-12-23 2024-01-16 Varmour Networks, Inc. Modeling queue-based message-oriented middleware relationships in a security system
US11777978B2 (en) 2021-01-29 2023-10-03 Varmour Networks, Inc. Methods and systems for accurately assessing application access risk
US12050693B2 (en) 2021-01-29 2024-07-30 Varmour Networks, Inc. System and method for attributing user behavior from multiple technical telemetry sources
US11764958B2 (en) 2021-04-06 2023-09-19 Capital One Services, Llc Systems and methods for dynamically encrypting redirect requests
US11734316B2 (en) 2021-07-08 2023-08-22 Varmour Networks, Inc. Relationship-based search in a computing environment

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6687353B1 (en) * 1998-12-11 2004-02-03 Securelogix Corporation System and method for bringing an in-line device on-line and assuming control of calls
US20050149748A1 (en) * 2003-12-19 2005-07-07 Spry Andrew J. Method and apparatus for identifying IPsec security policy in iSCSI

Family Cites Families (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5835726A (en) * 1993-12-15 1998-11-10 Check Point Software Technologies Ltd. System for securing the flow of and selectively modifying packets in a computer network
US5950195A (en) * 1996-09-18 1999-09-07 Secure Computing Corporation Generalized security policy management system and method
US5987611A (en) * 1996-12-31 1999-11-16 Zone Labs, Inc. System and methodology for managing internet access on a per application basis for client computers connected to the internet
US6182226B1 (en) * 1998-03-18 2001-01-30 Secure Computing Corporation System and method for controlling interactions between networks
US6453419B1 (en) * 1998-03-18 2002-09-17 Secure Computing Corporation System and method for implementing a security policy
US6304973B1 (en) * 1998-08-06 2001-10-16 Cryptek Secure Communications, Llc Multi-level security network system
JP3659052B2 (en) * 1999-02-23 2005-06-15 株式会社日立製作所 Network management system
JP2000324104A (en) * 1999-05-10 2000-11-24 Matsushita Electric Works Ltd Security policy setting method in virtual communication network, security policy manager and virtual communication network system using it
US7047288B2 (en) * 2000-01-07 2006-05-16 Securify, Inc. Automated generation of an english language representation of a formal network security policy specification
JP2001298449A (en) * 2000-04-12 2001-10-26 Matsushita Electric Ind Co Ltd Security communication method, communication system and its device
JP2001358716A (en) * 2000-06-12 2001-12-26 Nippon Telegr & Teleph Corp <Ntt> Logical closed network management method and apparatus, and recording medium storing program
US6826698B1 (en) * 2000-09-15 2004-11-30 Networks Associates Technology, Inc. System, method and computer program product for rule based network security policies
JP2003018156A (en) 2001-06-28 2003-01-17 Mitsubishi Electric Corp VPN operation management device
US7546629B2 (en) * 2002-03-06 2009-06-09 Check Point Software Technologies, Inc. System and methodology for security policy arbitration
US7159125B2 (en) * 2001-08-14 2007-01-02 Endforce, Inc. Policy engine for modular generation of policy for a flat, per-device database
US6928553B2 (en) * 2001-09-18 2005-08-09 Aastra Technologies Limited Providing internet protocol (IP) security
WO2003029916A2 (en) * 2001-09-28 2003-04-10 Bluesocket, Inc. Method and system for managing data traffic in wireless networks
GB2380279B (en) * 2001-10-01 2006-05-10 Soundvoice Ltd Computer firewall system and method
WO2004107130A2 (en) * 2003-05-28 2004-12-09 Caymas Systems, Inc. Multilayer access control security system
US7328451B2 (en) * 2003-06-30 2008-02-05 At&T Delaware Intellectual Property, Inc. Network firewall policy configuration facilitation
US20050138416A1 (en) * 2003-12-19 2005-06-23 Microsoft Corporation Object model for managing firewall services
US7441022B1 (en) * 2004-03-12 2008-10-21 Sun Microsystems, Inc. Resolving conflicts between network service rule sets for network data traffic in a system where rule patterns with longer prefixes match before rule patterns with shorter prefixes
CA2467603A1 (en) * 2004-05-18 2005-11-18 Ibm Canada Limited - Ibm Canada Limitee Visualization firewall rules in an auto provisioning environment
US20050268331A1 (en) * 2004-05-25 2005-12-01 Franck Le Extension to the firewall configuration protocols and features
FR2872983A1 (en) * 2004-07-09 2006-01-13 Thomson Licensing Sa FIREWALL PROTECTION SYSTEM FOR A COMMUNITY OF APPLIANCES, APPARATUS PARTICIPATING IN THE SYSTEM AND METHOD FOR UPDATING FIREWALL RULES WITHIN THE SYSTEM
US8595347B2 (en) * 2004-09-30 2013-11-26 Cisco Technology, Inc. Method and apparatus for device based policy configuration in a network
US7581241B2 (en) * 2005-07-15 2009-08-25 Microsoft Corporation Generating an outbound connection security policy based on an inbound connections security policy

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6687353B1 (en) * 1998-12-11 2004-02-03 Securelogix Corporation System and method for bringing an in-line device on-line and assuming control of calls
US20050149748A1 (en) * 2003-12-19 2005-07-07 Spry Andrew J. Method and apparatus for identifying IPsec security policy in iSCSI

Also Published As

Publication number Publication date
KR20080026177A (en) 2008-03-24
CN101238669A (en) 2008-08-06
EP1905180A2 (en) 2008-04-02
US20070016945A1 (en) 2007-01-18
US8490153B2 (en) 2013-07-16
WO2007011673A2 (en) 2007-01-25
JP2009502052A (en) 2009-01-22
US20120054825A1 (en) 2012-03-01
TW200713954A (en) 2007-04-01
US8056124B2 (en) 2011-11-08
JP4892554B2 (en) 2012-03-07

Similar Documents

Publication Publication Date Title
WO2007011673A3 (en) Automatically generating rules for connection security
WO2006115715A3 (en) System and method for enhanced protection and control over the use of identity
EP1677484A3 (en) Method and system for distributing security policies
Haitao Multiplicity and asymptotic behavior of positive solutions for a singular semilinear elliptic problem
TW200617702A (en) A method and system for enforcing a security policy via a security virtual machine
WO2002027656A3 (en) Selective smoothing and sharpening of images by generalized unsharp masking
IL176020A0 (en) Methods and compositions for the treatment and management of hemoglobinopathy and anemia
WO2009058740A3 (en) A language framework and infrastructure for safe and composable applications
GB2412540B (en) Methods and systems for managing security policies
AU2002234036A1 (en) Method and apparatus for session management and user authentication
AU2003260011A1 (en) System and method for user authentication with enhanced passwords
WO2007022489A3 (en) Wireless user network for handheld information terminals
IL174688A0 (en) Security document, method for producing a security document and the use of a security element
AU2003235144A1 (en) Aqueous polypropylene dispersion, aqueous polypropylene composite emulsion composition, and use thereof
MY147241A (en) Method and system for placing restrictions on sessions
WO2004086166A3 (en) Data protection management apparatus and data protection management method
WO2008073978A3 (en) Method and apparatus for dissociating binding information from objects to enable proper rights management
WO2004081756A3 (en) Trust governance framework
WO2006086686A3 (en) Methods and systems for communicating digital content
IL179190A0 (en) Stabilizing solutions for submicronic particles, methods for making the same and methods for stabilizing submicronic particles
EP1914654A3 (en) Method and apparatus for providing digital rights management content and license, and method and apparatus for using digital rights management content
WO2003034207A3 (en) Policy based system management
EP1592181A4 (en) Optical network, optical edge router, program thereof, cut through method, and edge router
EP1482693A3 (en) Enhanced virtual router redundancy protocol
WO2005010706A3 (en) System and method for optimizing sourcing opportunity utilization policies

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 200680025706.7

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 2006787203

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 36/DELNP/2008

Country of ref document: IN

ENP Entry into the national phase

Ref document number: 2008521620

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 1020087001180

Country of ref document: KR

NENP Non-entry into the national phase

Ref country code: DE

点击 这是indexloc提供的php浏览器服务，不要输入任何密码和下载